If clients are communicating well then check your client whether are having sufficient free space to install new definition, also there may be posibilities that client are corrupted or existing definition is courrupted.

When SEP first starts, it attempts to connect to SEPM without using a proxy. Regardless of the proxy setting the client always attempt to connect without a proxy first. If the client is unable to connect to any servers in its management server list, it will rotate its proxy settings at the end of the heartbeat. The next heartbeat will be attempted with proxy settings (if available). Once SEP is able to connect, it will not change its proxy settings until it is restarted. You could say it ‘locks’ the setting once it connects. This means that if the client connects without proxy, it will never connect via the proxy until it is restarted. If the client connects though the proxy, it will never connect directly to SEPM until it is restarted. Whichever one works first, that is the one the client will always use